@h402/cli 0.1.0

package/dist/ows.js

@@ -0,0 +1,61 @@
+const EVM_ADDRESS_PATTERN = /^0x[a-fA-F0-9]{40}$/;
+const HEX_SIGNATURE_PATTERN = /^(0x)?[a-fA-F0-9]+$/;
+let owsCorePromise;
+async function loadOwsCore() {
+    try {
+        owsCorePromise ??= import("@open-wallet-standard/core");
+        return await owsCorePromise;
+    }
+    catch (error) {
+        owsCorePromise = undefined;
+        throw new Error(`OWS wallet native bindings are unavailable on this platform: ${error instanceof Error ? error.message : String(error)}. ` +
+            "Non-wallet commands such as --help/search/quote can still run. Wallet creation and payment signing require @open-wallet-standard/core native bindings on macOS/Linux glibc x64/arm64.");
+    }
+}
+export function getEvmAddress(wallet) {
+    const account = wallet.accounts.find((candidate) => candidate.chainId === "eip155:8453") ??
+        wallet.accounts.find((candidate) => candidate.chainId.startsWith("eip155:")) ??
+        wallet.accounts.find((candidate) => EVM_ADDRESS_PATTERN.test(candidate.address));
+    if (!account || !EVM_ADDRESS_PATTERN.test(account.address)) {
+        throw new Error("OWS wallet was created but no EVM address was returned");
+    }
+    return account.address.toLowerCase();
+}
+export async function createOwsWallet(name, passphrase) {
+    const { createWallet } = await loadOwsCore();
+    const wallet = createWallet(name, passphrase);
+    return { name, address: getEvmAddress(wallet), wallet };
+}
+export async function getOwsWallet(name) {
+    const { getWallet } = await loadOwsCore();
+    const wallet = getWallet(name);
+    return { name: wallet.name, address: getEvmAddress(wallet), wallet };
+}
+export async function listOwsWallets() {
+    const { listWallets } = await loadOwsCore();
+    return listWallets().map((wallet) => ({ name: wallet.name, address: getEvmAddress(wallet), wallet }));
+}
+export function normalizeOwsSignature(signature, recoveryId) {
+    const normalized = signature.startsWith("0x") ? signature : `0x${signature}`;
+    if (!HEX_SIGNATURE_PATTERN.test(normalized)) {
+        throw new Error("OWS signMessage returned a non-hex signature");
+    }
+    if (normalized.length === 132) {
+        return normalized;
+    }
+    if (normalized.length === 130 && recoveryId !== undefined) {
+        const v = recoveryId > 1 ? recoveryId : recoveryId + 27;
+        return `${normalized}${v.toString(16).padStart(2, "0")}`;
+    }
+    throw new Error("OWS signMessage returned an invalid EVM signature length");
+}
+export async function signOwsMessage(walletName, message, passphrase) {
+    const { signMessage } = await loadOwsCore();
+    const result = signMessage(walletName, "base", message, passphrase);
+    return normalizeOwsSignature(result.signature, result.recoveryId);
+}
+export async function signOwsTypedData(walletName, typedData, passphrase) {
+    const { signTypedData } = await loadOwsCore();
+    const result = signTypedData(walletName, "base", JSON.stringify(typedData), passphrase);
+    return normalizeOwsSignature(result.signature, result.recoveryId);
+}

package/dist/prompt.js

@@ -0,0 +1,63 @@
+async function promptHidden(question) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new Error("Passphrase prompt requires an interactive terminal. Pass --no-passphrase if the wallet was created without one (the default agent setup), or set H402_WALLET_PASSPHRASE.");
+    }
+    return new Promise((resolve, reject) => {
+        const stdin = process.stdin;
+        const stdout = process.stdout;
+        const wasRaw = stdin.isRaw;
+        const wasPaused = stdin.isPaused();
+        let value = "";
+        const cleanup = () => {
+            stdin.off("data", onData);
+            if (stdin.isTTY) {
+                stdin.setRawMode(wasRaw);
+            }
+            if (wasPaused) {
+                stdin.pause();
+            }
+        };
+        const finish = () => {
+            stdout.write("\n");
+            cleanup();
+            resolve(value);
+        };
+        const onData = (chunk) => {
+            for (const char of chunk.toString("utf8")) {
+                if (char === "\u0003") {
+                    stdout.write("\n");
+                    cleanup();
+                    reject(new Error("Interrupted"));
+                    return;
+                }
+                if (char === "\r" || char === "\n") {
+                    finish();
+                    return;
+                }
+                if (char === "\u007f" || char === "\b") {
+                    value = value.slice(0, -1);
+                    continue;
+                }
+                value += char;
+            }
+        };
+        stdout.write(question);
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.on("data", onData);
+    });
+}
+export async function promptPassphrase(options) {
+    const passphrase = await promptHidden("Wallet passphrase: ");
+    if (!passphrase) {
+        throw new Error("Wallet passphrase cannot be empty.");
+    }
+    if (!options.confirm) {
+        return passphrase;
+    }
+    const confirmation = await promptHidden("Confirm wallet passphrase: ");
+    if (passphrase !== confirmation) {
+        throw new Error("Wallet passphrases do not match.");
+    }
+    return passphrase;
+}

package/dist/utils.js

@@ -0,0 +1,189 @@
+export function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export function mergeH402(body, patch) {
+    if (isRecord(body)) {
+        const h402 = isRecord(body.h402) ? body.h402 : {};
+        return { ...body, h402: { ...h402, ...patch } };
+    }
+    return { data: body, h402: patch };
+}
+export function parseArgs(argv) {
+    const positional = [];
+    const flags = {};
+    for (let index = 0; index < argv.length; index += 1) {
+        const value = argv[index];
+        if (!value.startsWith("--")) {
+            positional.push(value);
+            continue;
+        }
+        const rawName = value.slice(2);
+        const equalsIndex = rawName.indexOf("=");
+        if (equalsIndex >= 0) {
+            flags[rawName.slice(0, equalsIndex)] = rawName.slice(equalsIndex + 1);
+            continue;
+        }
+        const name = rawName;
+        const next = argv[index + 1];
+        if (!next || next.startsWith("--")) {
+            flags[name] = true;
+            continue;
+        }
+        flags[name] = next;
+        index += 1;
+    }
+    return { positional, flags };
+}
+export function flagString(flags, name, fallback) {
+    const value = flags[name];
+    if (typeof value === "string") {
+        return value;
+    }
+    return fallback;
+}
+export function flagBoolean(flags, name) {
+    return flags[name] === true || flags[name] === "true";
+}
+// Resolve the HTTP method for a proxy call. An explicit --method must be GET or POST
+// (case-insensitive, normalized to upper); anything else is rejected here instead of
+// being forwarded as an invalid method the backend answers with an opaque error.
+// Without --method, default to POST when there is a request body, else GET.
+export function resolveMethod(flags, hasBody) {
+    const raw = flagString(flags, "method");
+    if (raw === undefined) {
+        return hasBody ? "POST" : "GET";
+    }
+    const normalized = raw.toUpperCase();
+    if (normalized !== "GET" && normalized !== "POST") {
+        throw new Error(`Flag --method must be GET or POST (got "${raw}").`);
+    }
+    if (normalized === "GET" && hasBody) {
+        throw new Error("Flag --method GET cannot be combined with --json; GET requests must use --query for URL parameters.");
+    }
+    return normalized;
+}
+function flagValue(flags, name) {
+    const value = flags[name];
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string" || value === "") {
+        throw new Error(`Flag --${name} requires a value.`);
+    }
+    return value;
+}
+function jsonParseMessage(flag, value, example, error) {
+    const parserMessage = error instanceof Error ? error.message : String(error);
+    const keyValueHint = flag === "query" && /^[^=\s]+=/.test(value) ? " key=value syntax is not supported;" : "";
+    return `Flag --${flag} must be ${flag === "query" ? "a JSON object" : "valid JSON"}, e.g. --${flag} '${example}' (got ${JSON.stringify(value)};${keyValueHint} ${parserMessage}).`;
+}
+export function parseJsonFlag(flags) {
+    const value = flagValue(flags, "json");
+    if (value === undefined) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(value);
+    }
+    catch (error) {
+        throw new Error(jsonParseMessage("json", value, '{"query":"Seoul"}', error));
+    }
+}
+export function parseQueryFlag(flags) {
+    const value = flagValue(flags, "query");
+    if (value === undefined) {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch (error) {
+        throw new Error(jsonParseMessage("query", value, '{"q":"Seoul"}', error));
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`Flag --query must be a JSON object, e.g. --query '{"q":"Seoul"}' (got ${JSON.stringify(value)}).`);
+    }
+    return validateQueryParams(parsed);
+}
+function writeStream(stream, text) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => {
+            stream.off("drain", onDrain);
+            reject(error);
+        };
+        const onDrain = () => {
+            stream.off("error", onError);
+            resolve();
+        };
+        stream.once("error", onError);
+        if (stream.write(text)) {
+            stream.off("error", onError);
+            resolve();
+            return;
+        }
+        stream.once("drain", onDrain);
+    });
+}
+export function writeStdout(text) {
+    return writeStream(process.stdout, text);
+}
+export function writeStderr(text) {
+    return writeStream(process.stderr, text);
+}
+export function printJson(data) {
+    return writeStdout(`${JSON.stringify(data, null, 2)}\n`);
+}
+export function requireValue(value, message) {
+    if (value === undefined || value === null || value === "") {
+        throw new Error(message);
+    }
+    return value;
+}
+const PINNED_PATH_SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+export function assertConcreteProvider(provider) {
+    if (typeof provider !== "string" || !provider) {
+        throw new Error("Provider is required for a pinned route path");
+    }
+    if (provider.toLowerCase() === "auto") {
+        throw new Error('Provider "auto" is reserved for the retired routing endpoint; select a concrete provider.');
+    }
+    if (!PINNED_PATH_SLUG.test(provider)) {
+        throw new Error(`Provider must be a lowercase slug using letters, numbers, and single hyphens (got ${JSON.stringify(provider)}).`);
+    }
+    return provider;
+}
+export function encodeRouteId(routeId) {
+    const parts = routeId.split("/");
+    if (parts.length !== 2 || parts.some((part) => !part)) {
+        throw new Error("Route id must look like category/action");
+    }
+    for (const part of parts) {
+        if (!PINNED_PATH_SLUG.test(part)) {
+            throw new Error(`Route id segment must be a lowercase slug using letters, numbers, and single hyphens (got ${JSON.stringify(part)}).`);
+        }
+    }
+    return parts.map(encodeURIComponent).join("/");
+}
+function validateQueryParams(query) {
+    for (const [key, value] of Object.entries(query)) {
+        if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") {
+            throw new Error(`--query value for "${key}" must be a string, number, or boolean; arrays, objects, and null are not supported. Use --json for structured request bodies.`);
+        }
+    }
+    return query;
+}
+// Every execution path is provider-pinned. Callers must resolve an explicit
+// provider or the catalog's current display default before building this path.
+export function buildProxyPath(routeId, provider, query) {
+    const path = `/routes/${encodeURIComponent(assertConcreteProvider(provider))}/${encodeRouteId(routeId)}`;
+    if (!query) {
+        return path;
+    }
+    const searchParams = new URLSearchParams();
+    for (const [key, value] of Object.entries(validateQueryParams(query))) {
+        searchParams.set(key, String(value));
+    }
+    const queryString = searchParams.toString();
+    return queryString ? `${path}?${queryString}` : path;
+}

package/dist/x402.js

@@ -0,0 +1,53 @@
+import { BASE_CHAIN_ID, BASE_USDC_ADDRESS, USDC_EIP712_NAME, USDC_EIP712_VERSION, X402_VERSION, buildTransferAuthorization, encodeX402Header, selectExactRequirement, transferWithAuthorizationTypes } from "@h402/core";
+import { signOwsTypedData } from "./ows.js";
+export { X402_HEADERS, paymentRequiredFromResponse } from "@h402/core";
+// The CLI can only sign EIP-3009 Base USDC `exact` payments, so it must refuse to
+// sign anything else a backend offers — a non-USDC asset or a non-EIP-3009
+// transfer method (native, permit2, ...) would move funds in a way the user never
+// agreed to. The asset matcher is defensive: a malformed (non-string) asset is a
+// clean non-match, not a thrown error that would abort scanning valid entries.
+export const BASE_USDC_REQUIREMENT_OPTIONS = {
+    matchAsset: (asset) => typeof asset === "string" && asset.toLowerCase() === BASE_USDC_ADDRESS,
+    requireEip3009: true
+};
+export function selectBaseUsdcRequirement(paymentRequired) {
+    return selectExactRequirement(paymentRequired, BASE_USDC_REQUIREMENT_OPTIONS);
+}
+export async function createPaymentSignatureHeader(input) {
+    const accepted = selectBaseUsdcRequirement(input.paymentRequired);
+    const authorization = buildTransferAuthorization({
+        from: input.walletAddress,
+        to: accepted.payTo,
+        amount: accepted.amount,
+        maxTimeoutSeconds: accepted.maxTimeoutSeconds,
+        now: input.authorizationNow
+    });
+    const typedData = {
+        types: {
+            EIP712Domain: [
+                { name: "name", type: "string" },
+                { name: "version", type: "string" },
+                { name: "chainId", type: "uint256" },
+                { name: "verifyingContract", type: "address" }
+            ],
+            ...transferWithAuthorizationTypes
+        },
+        primaryType: "TransferWithAuthorization",
+        domain: {
+            name: USDC_EIP712_NAME,
+            version: USDC_EIP712_VERSION,
+            chainId: BASE_CHAIN_ID,
+            verifyingContract: accepted.asset
+        },
+        message: authorization
+    };
+    const signature = await signOwsTypedData(input.walletName, typedData, input.passphrase);
+    return encodeX402Header({
+        x402Version: X402_VERSION,
+        accepted,
+        payload: {
+            authorization,
+            signature
+        }
+    });
+}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@h402/cli",
+  "version": "0.1.0",
+  "description": "Local, non-custodial CLI for h402 — browse the catalog and pay per call in Base USDC over x402 from a local wallet.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "h402": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Steemhunt/h402-cli.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://h402.hunt.town",
+  "bugs": {
+    "url": "https://github.com/Steemhunt/h402-cli/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "x402",
+    "h402",
+    "ai-agents",
+    "agent",
+    "payments",
+    "usdc",
+    "base",
+    "cli"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepack": "npm run build -w @h402/core && npm run build",
+    "dev": "tsx src/index.ts",
+    "lint": "eslint .",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@h402/core": "^0.1.0",
+    "@open-wallet-standard/core": "^1.3.2",
+    "fs-native-extensions": "^1.5.0",
+    "undici": "^7.29.0"
+  }
+}